Roles

The Roles page allows organization owners to create custom permission sets that can be applied to users across different projects. This enables fine-grained access control and security management tailored to your organization's specific needs.

Accessing Roles Management

Navigation Path:

User Menu → My Organizations → [Select Organization] → Settings → Roles

Only users with Organization Owner role can access and create custom roles.

Roles Interface Overview

System Default Roles

Built-in Permission Sets

The system provides three essential roles that cannot be modified:

Admin Role

Permissions	Description
Project Settings Access	Can modify project configuration, databases, and settings
User Management	Can manage project members and roles
Job Execution	Can create, modify, and run jobs
Dataset Management	Can create, edit, and delete datasets
Rule Configuration	Can create and edit transformation rules
Limitations	Cannot delete or transfer project ownership

Use Cases:

Project administrators
Technical team leads
IT operations staff

Use Role

Permissions	Description
Project Content Management	Can edit and modify project content
Database Connections	Can create and manage database connections
Data Operations	Can mask databases and run transformation jobs
Deployments	Can execute deployments and manage data pipelines
Dataset Operations	Can work with datasets within the project
Limitations	Cannot change project-level settings or manage users

Use Cases:

Regular team members
Data engineers
ETL developers

View Role

Permissions	Description
Read Access	Can view project content and configurations
Database Access	Can connect to databases for read-only operations
Execution Access	Can view and monitor running jobs
Limitations	Cannot create connections, run jobs, or modify any data

Use Cases:

Business stakeholders
External auditors
Read-only analytics users
Compliance reviewers

Custom Roles

Creating Custom Roles

Organization owners can create specialized permission sets tailored to specific job functions and compliance requirements.

Role Creation Interface

Permission Categories

Project Management

Permission	Description	Security Impact
Create projects	Ability to create new projects in the organization	Medium - Can increase resource usage
Delete projects	Ability to permanently remove projects	High - Data loss risk
Edit project settings	Modify project configuration and parameters	Medium - Can affect data operations
Transfer project ownership	Change project ownership to another user	High - Control transfer risk
Manage project members	Add/remove users from projects, assign roles	Medium - Access control risk
Project billing	Access and modify billing-related settings	High - Financial risk

Data Operations

Permission	Description	Security Impact
Create datasets	Ability to create new dataset entries	Low - Content creation
Delete datasets	Remove datasets permanently	Medium - Data loss risk
Edit datasets	Modify existing dataset properties	Low - Content modification
Export datasets	Download datasets to local systems	High - Data exfiltration risk
Run jobs	Execute data processing and transformation jobs	Medium - Resource consumption
Delete jobs	Remove job records and history	Low - Cleanup operation
Schedule jobs	Set up automated job execution	Medium - Resource scheduling
Cancel jobs	Stop running or scheduled jobs	Low - Operation control

Database Connections

Permission	Description	Security Impact
Create connections	Add new database connections to projects	Medium - Increases attack surface
Delete connections	Remove database connections	Low - Reduces attack surface
Test connections	Verify database connectivity	Low - Testing capability
Modify connection security	Change authentication and encryption settings	High - Security configuration
Access production data	Connect to production databases	High - Production data risk
Access sensitive data	Work with highly sensitive or restricted data	Critical - Sensitive data exposure

Content Management

Permission	Description	Security Impact
View project content	Read access to project files and data	Low - Information disclosure
Edit project content	Modify files, configurations, and data	Medium - Data integrity risk
Create rules	Add new transformation and masking rules	Medium - Data processing control
Delete rules	Remove transformation rules	Medium - Processing impact
Upload files	Add files to project workspace	Low - File management
Delete files	Remove files from project workspace	Low - File management

Analytics and Reporting

Permission	Description	Security Impact
Run analytics	Execute analytics queries and reports	Medium - Data processing
View sensitive analytics	Access analytics on restricted data	High - Sensitive information access
Export reports	Download analytics and reports	High - Data exfiltration
Modify report templates	Change report formats and content	Low - Presentation customization
View audit logs	Access system and project audit trails	Medium - Visibility of user activities
Clear audit logs	Remove entries from audit history	High - Evidence destruction risk

Common Custom Role Examples

Data Analyst Role

Purpose: Analytics and reporting without production data access

Recommended Permissions:

✅ Create datasets, Edit datasets, Export datasets
✅ Run jobs, View project content
✅ Run analytics, Export reports, View audit logs
❌ Access production data, Access sensitive data
❌ Create/delete connections, Edit project settings

Security Auditor Role

Purpose: Compliance and auditing with full read access

Recommended Permissions:

✅ View project content, View audit logs
✅ Run analytics, Export reports
✅ Access sensitive analytics (for compliance review)
❌ Create/delete/modify anything
❌ Access production data (unless required for audit)

Database Administrator Role

Purpose: Database management without data processing

Recommended Permissions:

✅ Create/delete connections, Test connections
✅ Modify connection security, Access production data
❌ Run jobs, Create/delete datasets, Edit project content
❌ Manage project members, Transfer ownership

Project Lead Role

Purpose: Day-to-day project management without ownership changes

Recommended Permissions:

✅ Edit project settings, Manage project members
✅ Create/delete datasets, Run/Cancel jobs
✅ Create/delete rules, Upload/delete files
❌ Delete projects, Transfer ownership, Project billing

Role Management Features

Role Identification

Visual Indicators:

Default Roles: No special indicator (system built-in)
Custom Roles: [Custom] tag displayed next to role name
Edit Access: [Edit] button appears for custom roles only

Role Modifications

Editing Custom Roles

Only organization owners can edit custom roles
All existing users with the role will receive updated permissions
Changes are logged in audit trail with timestamp and editor
Cannot edit built-in system roles

Deleting Custom Roles

Confirmation dialog with impact assessment
Users assigned to deleted role automatically get View permissions
Cannot delete roles that are in use by project owners
Requires organization owner confirmation

Role Assignment

Project-Level Application

Custom roles can only be assigned at the project level
Same user can have different roles in different projects
Role changes apply immediately to user sessions
Bulk user assignment supported through member management

Role Inheritance

Organization roles provide default project access
Project-specific roles override organization defaults
Minimum permission principle applies when conflicts occur

Security Best Practices

Role Design Principles

Principle of Least Privilege
- Only grant permissions absolutely necessary for the job function
- Start with minimal permissions and add only when justified
- Regular review of role assignments and necessity
Separation of Duties
- Divide critical functions across multiple users
- Prevent single-user control over entire data lifecycle
- Implement approval workflows for high-risk operations
Regular Auditing
- Monitor role usage and access patterns
- Review custom role effectiveness quarterly
- Audit role assignments for appropriate user access